bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Simon Pugnet]

[-- Attachment #1: Type: text/plain, Size: 8943 bytes --]

Emacs can be made to crash with a segmentation fault on Linux when 
navigating an Org mode buffer after hiding headlines with 
~outline-hide-other~. This only happens when ~visual-line-mode~ 
and ~display-line-numbers-mode~ are active and 
~display-line-numbers-type~ is set to ~'visual~.

This bug can be replicated on a build from the current HEAD of 
emacs-27 (395f10cb98af122404bcdc2eb60d30decf297625) as well as the 
current HEAD of master (de54cd6f0edb3619777c17fe75560c5c84fed8a4). 
This bug report was produced from a version compiled from 
395f10cb98af122404bcdc2eb60d30decf297625.

Steps to reproduce: -

1. Launch ~emacs -Q~
2. Enable "visual" line numbers (~(setq display-line-numbers-type 
'visual)~)
3. Create an Org mode buffer with the following content: -
   * Heading 1
   ** Heading 1a
   ** Heading 1b
4. Enable ~display-line-numbers-mode~
5. Enable ~visual-line-mode~
6. Move the point anywhere on the line with "Heading 1b"
7. Call ~outline-hide-other~
8. Call ~previous-line~ (via keybinding or directly)

Emacs then crashes with SIGSEGV.

Debugging emacs in GDB while doing this seems to show a loop as 
follows: -

  Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
  0x00005555555d1b39 in move_it_in_display_line_to 
  (it=it@entry=0x7fffff6734e0, to_charpos=to_charpos@entry=171, 
  to_x=to_x@entry=-1, op=op@entry=MOVE_TO_POS) at xdisp.c:9009
  9009    {
  (gdb) bt
  #0  0x00005555555d1b39 in move_it_in_display_line_to 
  (it=it@entry=0x7fffff6734e0, to_charpos=to_charpos@entry=171, 
  to_x=to_x@entry=-1, op=op@entry=MOVE_TO_POS) at xdisp.c:9009
  #1  0x00005555555d6bbd in move_it_to (it=0x7fffff6734e0, 
  to_charpos=171, to_x=<optimised out>, to_y=<optimised out>, 
  to_vpos=<optimised out>, op=8) at xdisp.c:9889
  #2  0x00005555555d0e92 in start_display 
  (it=it@entry=0x7fffff6734e0, w=0x555555eeffa0, pos=...) at 
  xdisp.c:6866
  #3  0x00005555555d1a50 in display_count_lines_visually 
  (it=0x7fffff67bc70) at xdisp.c:22685
  #4  maybe_produce_line_number (it=it@entry=0x7fffff67bc70) at 
  xdisp.c:22729
  #5  0x00005555555d2e11 in move_it_in_display_line_to 
  (it=it@entry=0x7fffff67bc70, to_charpos=to_charpos@entry=171, 
  to_x=to_x@entry=-1, op=op@entry=MOVE_TO_POS) at xdisp.c:9079
  #6  0x00005555555d6bbd in move_it_to (it=0x7fffff67bc70, 
  to_charpos=171, to_x=<optimised out>, to_y=<optimised out>, 
  to_vpos=<optimised out>, op=8) at xdisp.c:9889
  #7  0x00005555555d0e92 in start_display 
  (it=it@entry=0x7fffff67bc70, w=0x555555eeffa0, pos=...) at 
  xdisp.c:6866
  #8  0x00005555555d1a50 in display_count_lines_visually 
  (it=0x7fffff684400) at xdisp.c:22685
  #9  maybe_produce_line_number (it=it@entry=0x7fffff684400) at 
  xdisp.c:22729
  (... sequence repeats ...)
  #1439 maybe_produce_line_number (it=it@entry=0x7fffffffb6a0) at 
  xdisp.c:22729
  #1440 0x00005555555d2e11 in move_it_in_display_line_to 
  (it=it@entry=0x7fffffffb6a0, to_charpos=to_charpos@entry=171, 
  to_x=to_x@entry=-1, op=op@entry=MOVE_TO_POS) at xdisp.c:9079
  #1441 0x00005555555d6bbd in move_it_to (it=0x7fffffffb6a0, 
  to_charpos=171, to_x=<optimised out>, to_y=<optimised out>, 
  to_vpos=<optimised out>, op=8) at xdisp.c:9889
  #1442 0x00005555555d0e92 in start_display 
  (it=it@entry=0x7fffffffb6a0, w=w@entry=0x555555eeffa0, pos=...) 
  at xdisp.c:6866
  #1443 0x00005555555d7af4 in Fline_pixel_height () at 
  xdisp.c:1422
  #1444 0x00005555556fdae3 in Ffuncall (nargs=1, 
  args=args@entry=0x7fffffffca70) at lisp.h:2110
  #1445 0x00005555557342cc in exec_byte_code (bytestr=<optimised 
  out>, vector=<optimised out>, maxdepth=<optimised out>, 
  args_template=<optimised out>, nargs=<optimised out>, 
  args=<optimised out>) at bytecode.c:633
  #1446 0x00005555556fda47 in Ffuncall (nargs=5, 
  args=args@entry=0x7fffffffce48) at eval.c:2809
  #1447 0x00005555557342cc in exec_byte_code (bytestr=<optimised 
  out>, vector=<optimised out>, maxdepth=<optimised out>, 
  args_template=<optimised out>, nargs=<optimised out>, 
  args=<optimised out>) at bytecode.c:633
  #1448 0x00005555556fda47 in Ffuncall (nargs=nargs@entry=3, 
  args=args@entry=0x7fffffffd208) at eval.c:2809
  #1449 0x00005555556fa295 in Ffuncall_interactively (nargs=3, 
  args=0x7fffffffd208) at callint.c:254
  #1450 0x00005555556fdae3 in Ffuncall (nargs=nargs@entry=4, 
  args=args@entry=0x7fffffffd200) at lisp.h:2110
  #1451 0x00005555556fb676 in Fcall_interactively 
  (function=<optimised out>, record_flag=<optimised out>, 
  keys=<optimised out>) at callint.c:783
  #1452 0x00005555556fdae3 in Ffuncall (nargs=4, 
  args=args@entry=0x7fffffffd438) at lisp.h:2110
  #1453 0x00005555557342cc in exec_byte_code (bytestr=<optimised 
  out>, vector=<optimised out>, maxdepth=<optimised out>, 
  args_template=<optimised out>, nargs=<optimised out>, 
  args=<optimised out>) at bytecode.c:633
  #1454 0x00005555556fda47 in Ffuncall (nargs=2, 
  args=0x7fffffffd7e0) at eval.c:2809
  #1455 0x00005555556fdbce in call1 (fn=fn@entry=0x4380, 
  arg1=<optimised out>) at eval.c:2655
  #1456 0x00005555556937e8 in command_loop_1 () at lisp.h:1033
  #1457 0x00005555556fcd17 in internal_condition_case 
  (bfun=bfun@entry=0x5555556933f0 <command_loop_1>, 
  handlers=handlers@entry=0x90, hfun=hfun@entry=0x55555568a0f0 
  <cmd_error>) at eval.c:1356
  #1458 0x0000555555684bb4 in command_loop_2 
  (ignore=ignore@entry=0x0) at lisp.h:1033
  #1459 0x00005555556fcc59 in internal_catch 
  (tag=tag@entry=0xd5c0, func=func@entry=0x555555684b90 
  <command_loop_2>, arg=arg@entry=0x0) at eval.c:1117
  #1460 0x0000555555684b53 in command_loop () at lisp.h:1033
  #1461 0x0000555555689cfa in recursive_edit_1 () at 
  keyboard.c:714
  #1462 0x000055555568a036 in Frecursive_edit () at keyboard.c:786
  #1463 0x00005555555a69b7 in main (argc=2, argv=<optimised out>) 
  at emacs.c:2066


In GNU Emacs 27.1.50 (build 2, x86_64-pc-linux-gnu, GTK+ Version 
3.24.20, cairo version 1.16.0) of 2020-09-24 built on karnak
Repository revision: 395f10cb98af122404bcdc2eb60d30decf297625
Repository branch: emacs-27
Windowing system distributor 'The X.Org Foundation', version 
11.0.12008000
System Description: Ubuntu 20.04.1 LTS

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list...

Configured using:
 'configure --with-cairo --with-mailutils --with-xwidgets 
 --with-json'

Configured features:
XPM JPEG TIFF GIF PNG RSVG CAIRO SOUND GPM DBUS GSETTINGS GLIB 
NOTIFY
INOTIFY ACL LIBSELINUX GNUTLS LIBXML2 FREETYPE HARFBUZZ M17N_FLT 
LIBOTF
ZLIB TOOLKIT_SCROLL_BARS GTK3 X11 XDBE XIM MODULES THREADS 
XWIDGETS
LIBSYSTEMD JSON PDUMPER LCMS2 GMP

Important settings:
  value of $LC_CTYPE: en_GB.UTF-8
  value of $LANG: en_GB.UTF-8
  value of $XMODIFIERS: @im=ibus
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message rmc puny dired 
dired-loaddefs
format-spec rfc822 mml easymenu mml-sec password-cache epa derived 
epg
epg-config gnus-util rmail rmail-loaddefs text-property-search 
time-date
subr-x seq byte-opt gv bytecomp byte-compile cconv mm-decode 
mm-bodies
mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader 
cl-loaddefs
cl-lib sendmail rfc2047 rfc2045 ietf-drums mm-util mail-prsvr 
mail-utils
tooltip eldoc electric uniquify ediff-hook vc-hooks 
lisp-float-type
mwheel term/x-win x-win term/common-win x-dnd tool-bar dnd fontset 
image
regexp-opt fringe tabulated-list replace newcomment text-mode 
elisp-mode
lisp-mode prog-mode register page tab-bar menu-bar rfn-eshadow 
isearch
timer select scroll-bar mouse jit-lock font-lock syntax facemenu
font-core term/tty-colors frame minibuffer cl-generic cham 
georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech 
european
ethiopic indian cyrillic chinese composite charscript charprop
case-table epa-hook jka-cmpr-hook help simple abbrev obarray
cl-preloaded nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote threads dbusbind
inotify lcms2 dynamic-setting system-font-setting 
font-render-setting
xwidget-internal cairo move-toolbar gtk x-toolkit x multi-tty
make-network-process emacs)

Memory information:
((conses 16 45107 8742)
 (symbols 48 6009 1)
 (strings 32 15461 1341)
 (string-bytes 1 507002)
 (vectors 16 10094)
 (vector-slots 8 130013 7762)
 (floats 8 20 43)
 (intervals 56 236 0)
 (buffers 1000 12))

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Eli Zaretskii]

> From: Simon Pugnet <simon@polaris64.net>
> Date: Thu, 24 Sep 2020 13:51:54 +0100
> 
> 1. Launch ~emacs -Q~
> 2. Enable "visual" line numbers (~(setq display-line-numbers-type 
> 'visual)~)
> 3. Create an Org mode buffer with the following content: -
>    * Heading 1
>    ** Heading 1a
>    ** Heading 1b
> 4. Enable ~display-line-numbers-mode~
> 5. Enable ~visual-line-mode~
> 6. Move the point anywhere on the line with "Heading 1b"
> 7. Call ~outline-hide-other~
> 8. Call ~previous-line~ (via keybinding or directly)
> 
> Emacs then crashes with SIGSEGV.

I couldn't reproduce this on my system.

> Debugging emacs in GDB while doing this seems to show a loop as 
> follows: -
> 
>   Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
>   0x00005555555d1b39 in move_it_in_display_line_to 
>   (it=it@entry=0x7fffff6734e0, to_charpos=to_charpos@entry=171, 
>   to_x=to_x@entry=-1, op=op@entry=MOVE_TO_POS) at xdisp.c:9009
>   9009    {

This sounds like infinite recursion that causes stack overflow.  Not
sure why it happens in your case but not in mine.  Are you trying this
on a GUI frame or a TTY frame?  (I tried both, but couldn't reproduce
on either.)

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Simon Pugnet]

[-- Attachment #1: Type: text/plain, Size: 4325 bytes --]


Eli Zaretskii <eliz@gnu.org> writes:

>
> This sounds like infinite recursion that causes stack overflow. 
> Not
> sure why it happens in your case but not in mine.  Are you 
> trying this
> on a GUI frame or a TTY frame?  (I tried both, but couldn't 
> reproduce
> on either.)

Hello Eli,

Thanks for your reply.

I tried it originally in a GUI frame but I just tried the same 
procedure again using ~emacs -Q -nw~ and I got the same results. 
Here's the partial GDB back-trace: -

  #0  0x00005555555d1b39 in move_it_in_display_line_to 
  (it=it@entry=0x7fffff6734f0, to_charpos=to_charpos@entry=171, 
  to_x=to_x@entry=-1, op=op@entry=MOVE_TO_POS) at xdisp.c:9009
  #1  0x00005555555d6bbd in move_it_to (it=0x7fffff6734f0, 
  to_charpos=171, to_x=<optimised out>, to_y=<optimised out>, 
  to_vpos=<optimised out>, op=8) at xdisp.c:9889
  #2  0x00005555555d0e92 in start_display 
  (it=it@entry=0x7fffff6734f0, w=0x555555c366a0, pos=...) at 
  xdisp.c:6866
  #3  0x00005555555d1a50 in display_count_lines_visually 
  (it=0x7fffff67bc80) at xdisp.c:22685
  #4  maybe_produce_line_number (it=it@entry=0x7fffff67bc80) at 
  xdisp.c:22729
  (...repeats...)
  #1438 0x00005555555d1a50 in display_count_lines_visually 
  (it=0x7fffffffb6b0) at xdisp.c:22685
  #1439 maybe_produce_line_number (it=it@entry=0x7fffffffb6b0) at 
  xdisp.c:22729
  #1440 0x00005555555d2e11 in move_it_in_display_line_to 
  (it=it@entry=0x7fffffffb6b0, to_charpos=to_charpos@entry=171, 
  to_x=to_x@entry=-1, op=op@entry=MOVE_TO_POS) at xdisp.c:9079
  #1441 0x00005555555d6bbd in move_it_to (it=0x7fffffffb6b0, 
  to_charpos=171, to_x=<optimised out>, to_y=<optimised out>, 
  to_vpos=<optimised out>, op=8) at xdisp.c:9889
  #1442 0x00005555555d0e92 in start_display 
  (it=it@entry=0x7fffffffb6b0, w=w@entry=0x555555c366a0, pos=...) 
  at xdisp.c:6866
  #1443 0x00005555555d7af4 in Fline_pixel_height () at 
  xdisp.c:1422
  #1444 0x00005555556fdae3 in Ffuncall (nargs=1, 
  args=args@entry=0x7fffffffca80) at lisp.h:2110
  #1445 0x00005555557342cc in exec_byte_code (bytestr=<optimised 
  out>, vector=<optimised out>, maxdepth=<optimised out>, 
  args_template=<optimised out>, nargs=<optimised out>, 
  args=<optimised out>) at bytecode.c:633
  #1446 0x00005555556fda47 in Ffuncall (nargs=5, 
  args=args@entry=0x7fffffffce58) at eval.c:2809
  #1447 0x00005555557342cc in exec_byte_code (bytestr=<optimised 
  out>, vector=<optimised out>, maxdepth=<optimised out>, 
  args_template=<optimised out>, nargs=<optimised out>, 
  args=<optimised out>) at bytecode.c:633
  #1448 0x00005555556fda47 in Ffuncall (nargs=nargs@entry=3, 
  args=args@entry=0x7fffffffd218) at eval.c:2809
  #1449 0x00005555556fa295 in Ffuncall_interactively (nargs=3, 
  args=0x7fffffffd218) at callint.c:254
  #1450 0x00005555556fdae3 in Ffuncall (nargs=nargs@entry=4, 
  args=args@entry=0x7fffffffd210) at lisp.h:2110
  #1451 0x00005555556fb676 in Fcall_interactively 
  (function=<optimised out>, record_flag=<optimised out>, 
  keys=<optimised out>) at callint.c:783
  #1452 0x00005555556fdae3 in Ffuncall (nargs=4, 
  args=args@entry=0x7fffffffd448) at lisp.h:2110
  #1453 0x00005555557342cc in exec_byte_code (bytestr=<optimised 
  out>, vector=<optimised out>, maxdepth=<optimised out>, 
  args_template=<optimised out>, nargs=<optimised out>, 
  args=<optimised out>) at bytecode.c:633
  #1454 0x00005555556fda47 in Ffuncall (nargs=2, 
  args=0x7fffffffd7f0) at eval.c:2809
  #1455 0x00005555556fdbce in call1 (fn=fn@entry=0x4380, 
  arg1=<optimised out>) at eval.c:2655
  #1456 0x00005555556937e8 in command_loop_1 () at lisp.h:1033
  #1457 0x00005555556fcd17 in internal_condition_case 
  (bfun=bfun@entry=0x5555556933f0 <command_loop_1>, 
  handlers=handlers@entry=0x90, hfun=hfun@entry=0x55555568a0f0 
  <cmd_error>) at eval.c:1356
  #1458 0x0000555555684bb4 in command_loop_2 
  (ignore=ignore@entry=0x0) at lisp.h:1033
  #1459 0x00005555556fcc59 in internal_catch 
  (tag=tag@entry=0xd5c0, func=func@entry=0x555555684b90 
  <command_loop_2>, arg=arg@entry=0x0) at eval.c:1117
  #1460 0x0000555555684b53 in command_loop () at lisp.h:1033
  #1461 0x0000555555689cfa in recursive_edit_1 () at 
  keyboard.c:714
  #1462 0x000055555568a036 in Frecursive_edit () at keyboard.c:786
  #1463 0x00005555555a69b7 in main (argc=3, argv=<optimised out>) 
  at emacs.c:2066

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Simon Pugnet]

[-- Attachment #1: Type: text/plain, Size: 315 bytes --]


Eli Zaretskii <eliz@gnu.org> writes:

>
> I couldn't reproduce this on my system.
>

I've just tried this on Emacs 26.3 on my Android device under 
Termux (ARM build) and I also get a segmentation fault. 
Unfortunately I cannot do this in GDB under this environment so I 
cannot get a back-trace in this instance.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Eli Zaretskii]

> From: Simon Pugnet <simon@polaris64.net>
> Cc: 43589@debbugs.gnu.org
> Date: Thu, 24 Sep 2020 16:35:01 +0100
> 
> I tried it originally in a GUI frame but I just tried the same 
> procedure again using ~emacs -Q -nw~ and I got the same results. 

This is very strange, since I don't get any problems like that.

Are you sure you don't have any local changes wrt the current Git
repository?  Or maybe some other software installed on your system has
this effect?

Can anyone else reproduce this problem with the provided recipe?

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Unknown]

Eli Zaretskii <eliz@gnu.org> writes:
>
> Can anyone else reproduce this problem with the provided recipe?

I could reproduce the crash only once on macOS and Emacs 27.1, but I
can't reproduce the issue anymore. I'm not exactly sure if I did
something differently.

Simon, if you can reproduce the problem consistently, could you describe
in more detail the position of point at each step? Are you copying and
pasting the sample Org document? Perhaps those implicit assumptions are
making the problem harder to reproduce. Thanks.

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Simon Pugnet]

[-- Attachment #1: Type: text/plain, Size: 1351 bytes --]

Daniel Martín <mardani29@yahoo.es> writes:

> Simon, if you can reproduce the problem consistently, could you 
> describe
> in more detail the position of point at each step? Are you 
> copying and
> pasting the sample Org document? Perhaps those implicit 
> assumptions are
> making the problem harder to reproduce. Thanks.

Hello Daniel and Eli,

Here's a more detailed explanation of exactly what I'm dong to 
cause this issue.

1. Execute: emacs -Q
2. In the scratch buffer that opens by default, activate Org mode: 
M-x org-mode
3. Type the following directly into the buffer (3 lines): -

* Heading 1
** Heading 1a
** Heading 1b

4. The point should now be after the "b" in "Heading 1b"
5. Evaluate (M-:) the following: (setq display-line-numbers-type 
'visual)
6. Activate display-line-numbers-mode: M-x 
display-line-numbers-mode
7. Activate visual-line-mode: M-x visual-line-mode
8. Hide other outline headings: M-x outline-hide-other
9. Try to move the point to the previous line: C-p or 
previous-line

If I perform these steps on Emacs 27.1 (GUI or text frame), and 
also the packaged version of Emacs 26.3 on Android (via the Termux 
app), I always get a segmentation fault.

This happens in other Org mode buffers too, including those loaded 
directly from the file system.

I hope that helps!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Andy Moreton]

On Thu 24 Sep 2020, Simon Pugnet wrote:

> Daniel Martín <mardani29@yahoo.es> writes:
>
>> Simon, if you can reproduce the problem consistently, could you describe
>> in more detail the position of point at each step? Are you copying and
>> pasting the sample Org document? Perhaps those implicit assumptions are
>> making the problem harder to reproduce. Thanks.
>
> Hello Daniel and Eli,
>
> Here's a more detailed explanation of exactly what I'm dong to cause this
> issue.
>
> 1. Execute: emacs -Q
> 2. In the scratch buffer that opens by default, activate Org mode: M-x
> org-mode
> 3. Type the following directly into the buffer (3 lines): -
>
> * Heading 1
> ** Heading 1a
> ** Heading 1b
>
> 4. The point should now be after the "b" in "Heading 1b"
> 5. Evaluate (M-:) the following: (setq display-line-numbers-type 'visual)
> 6. Activate display-line-numbers-mode: M-x display-line-numbers-mode
> 7. Activate visual-line-mode: M-x visual-line-mode
> 8. Hide other outline headings: M-x outline-hide-other
> 9. Try to move the point to the previous line: C-p or previous-line
>
> If I perform these steps on Emacs 27.1 (GUI or text frame), and also the
> packaged version of Emacs 26.3 on Android (via the Termux app), I always get a
> segmentation fault.
>
> This happens in other Org mode buffers too, including those loaded directly
> from the file system.
>
> I hope that helps!

With this recipe, I can reliably reproduce this on 64bit mingw64 on
Windows (built with -O2). Running this produces the message:

    Re-entering top level after C stack overflow

... which confirms Eli's hunch about the cause. Running the same recipe
under gdb, I get the following backtrace:

(gdb) bt
#0  0x000000006f8d0f25 in ?? () from C:\msys64\mingw64\bin\libharfbuzz-0.dll
#1  0x000000006f85a24b in ?? () from C:\msys64\mingw64\bin\libharfbuzz-0.dll
#2  0x000000006f8526cb in ?? () from C:\msys64\mingw64\bin\libharfbuzz-0.dll
#3  0x00000004001c0367 in w32hb_encode_char (font=0x5698a90, c=0x5c) at C:/emacs/git/emacs/master/src/w32uniscribe.c:1359
#4  0x000000040004ba06 in get_char_glyph_code (char2b=0x4041cc, font=0x5698a90, c=<optimized out>) at C:/emacs/git/emacs/master/src/xdisp.c:27746
#5  gui_produce_glyphs (it=0x404270) at C:/emacs/git/emacs/master/src/xdisp.c:30173
#6  0x000000040001e204 in produce_special_glyphs (it=it@entry=0x405750, what=what@entry=IT_CONTINUATION) at C:/emacs/git/emacs/master/src/xdisp.c:29779
#7  0x000000040002ca1d in init_iterator (it=it@entry=0x405750, w=w@entry=0x5698320, charpos=0xab, bytepos=<optimized out>, row=0x578bc00, base_face_id=<optimized out>, base_face_id@entry=DEFAULT_FACE_ID) at C:/emacs/git/emacs/master/src/xdisp.c:3286
#8  0x000000040002e321 in start_display (it=it@entry=0x405750, w=0x5698320, pos=...) at C:/emacs/git/emacs/master/src/xdisp.c:3459
#9  0x000000040002f02c in display_count_lines_visually (it=0x40dfe0) at C:/emacs/git/emacs/master/src/xdisp.c:22824
#10 maybe_produce_line_number (it=it@entry=0x40dfe0) at C:/emacs/git/emacs/master/src/xdisp.c:22868
#11 0x0000000400030580 in move_it_in_display_line_to (it=it@entry=0x40dfe0, to_charpos=to_charpos@entry=0xab, to_x=to_x@entry=0xffffffff, op=op@entry=MOVE_TO_POS) at C:/emacs/git/emacs/master/src/xdisp.c:9184
#12 0x00000004000344af in move_it_to (it=<optimized out>, it@entry=0x40dfe0, to_charpos=to_charpos@entry=0xab, to_x=<optimized out>, to_x@entry=0xffffffff, to_y=<optimized out>, to_y@entry=0xffffffff, to_vpos=<optimized out>, to_vpos@entry=0xffffffff, op=<optimized out>, op@entry=0x8) at C:/emacs/git/emacs/master/src/xdisp.c:10006
#13 0x000000040002e3da in start_display (it=it@entry=0x40dfe0, w=0x5698320, pos=...) at C:/emacs/git/emacs/master/src/xdisp.c:6968
#14 0x000000040002f02c in display_count_lines_visually (it=0x416870) at C:/emacs/git/emacs/master/src/xdisp.c:22824
#15 maybe_produce_line_number (it=it@entry=0x416870) at C:/emacs/git/emacs/master/src/xdisp.c:22868
#16 0x0000000400030580 in move_it_in_display_line_to (it=it@entry=0x416870, to_charpos=to_charpos@entry=0xab, to_x=to_x@entry=0xffffffff, op=op@entry=MOVE_TO_POS) at C:/emacs/git/emacs/master/src/xdisp.c:9184
#17 0x00000004000344af in move_it_to (it=<optimized out>, it@entry=0x416870, to_charpos=to_charpos@entry=0xab, to_x=<optimized out>, to_x@entry=0xffffffff, to_y=<optimized out>, to_y@entry=0xffffffff, to_vpos=<optimized out>, to_vpos@entry=0xffffffff, op=<optimized out>, op@entry=0x8) at C:/emacs/git/emacs/master/src/xdisp.c:10006
#18 0x000000040002e3da in start_display (it=it@entry=0x416870, w=0x5698320, pos=...) at C:/emacs/git/emacs/master/src/xdisp.c:6968
#19 0x000000040002f02c in display_count_lines_visually (it=0x41f100) at C:/emacs/git/emacs/master/src/xdisp.c:22824

   ... (truncated for brevity) ...

#1200 maybe_produce_line_number (it=it@entry=0xbfd550) at C:/emacs/git/emacs/master/src/xdisp.c:22868
#1201 0x0000000400030580 in move_it_in_display_line_to (it=it@entry=0xbfd550, to_charpos=to_charpos@entry=0xab, to_x=to_x@entry=0xffffffff, op=op@entry=MOVE_TO_POS) at C:/emacs/git/emacs/master/src/xdisp.c:9184
#1202 0x00000004000344af in move_it_to (it=<optimized out>, it@entry=0xbfd550, to_charpos=to_charpos@entry=0xab, to_x=<optimized out>, to_x@entry=0xffffffff, to_y=<optimized out>, to_y@entry=0xffffffff, to_vpos=<optimized out>, to_vpos@entry=0xffffffff, op=<optimized out>, op@entry=0x8) at C:/emacs/git/emacs/master/src/xdisp.c:10006
#1203 0x000000040002e3da in start_display (it=it@entry=0xbfd550, w=w@entry=0x5698320, pos=...) at C:/emacs/git/emacs/master/src/xdisp.c:6968
#1204 0x000000040003556d in Fline_pixel_height () at C:/emacs/git/emacs/master/src/xdisp.c:1494
#1205 0x0000000400130347 in Ffuncall (nargs=<optimized out>, args=args@entry=0xbfe960) at C:/emacs/git/emacs/master/src/lisp.h:2080
#1206 0x000000040016b6f0 in exec_byte_code (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=args_template@entry=make_fixnum(1025), nargs=nargs@entry=0x4, args=<optimized out>, args@entry=0xbfec70) at C:/emacs/git/emacs/master/src/bytecode.c:632
#1207 0x000000040013345b in fetch_and_exec_byte_code (args=0xbfec70, nargs=0x4, syms_left=make_fixnum(1025), fun=XIL(0x3fecff5)) at C:/emacs/git/emacs/master/src/lisp.h:1835
#1208 funcall_lambda (fun=XIL(0x3fecff5), nargs=nargs@entry=0x4, arg_vector=arg_vector@entry=0xbfec70) at C:/emacs/git/emacs/master/src/eval.c:3007
#1209 0x000000040013027b in Ffuncall (nargs=0x5, args=args@entry=0xbfec68) at C:/emacs/git/emacs/master/src/eval.c:2818
#1210 0x000000040016b6f0 in exec_byte_code (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=args_template@entry=make_fixnum(512), nargs=nargs@entry=0x2, args=<optimized out>, args@entry=0xbfefc0) at C:/emacs/git/emacs/master/src/bytecode.c:632
#1211 0x000000040013345b in fetch_and_exec_byte_code (args=0xbfefc0, nargs=0x2, syms_left=make_fixnum(512), fun=XIL(0x3fed59d)) at C:/emacs/git/emacs/master/src/lisp.h:1835
#1212 funcall_lambda (fun=XIL(0x3fed59d), nargs=nargs@entry=0x2, arg_vector=arg_vector@entry=0xbfefc0) at C:/emacs/git/emacs/master/src/eval.c:3007
#1213 0x000000040013027b in Ffuncall (nargs=nargs@entry=0x3, args=args@entry=0xbfefb8) at C:/emacs/git/emacs/master/src/eval.c:2818
#1214 0x000000040012c979 in Ffuncall_interactively (nargs=0x3, args=0xbfefb8) at C:/emacs/git/emacs/master/src/callint.c:253
#1215 0x0000000400130347 in Ffuncall (nargs=nargs@entry=0x875c815, args=0xbfefb0, args@entry=0xbff260) at C:/emacs/git/emacs/master/src/lisp.h:2080
#1216 0x000000040012dcaf in Fcall_interactively (function=<optimized out>, record_flag=<optimized out>, keys=<optimized out>) at C:/emacs/git/emacs/master/src/callint.c:779
#1217 0x0000000400130347 in Ffuncall (nargs=<optimized out>, args=args@entry=0xbff228) at C:/emacs/git/emacs/master/src/lisp.h:2080
#1218 0x000000040016b6f0 in exec_byte_code (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=args_template@entry=make_fixnum(1025), nargs=nargs@entry=0x1, args=<optimized out>, args@entry=0xbff4f8) at C:/emacs/git/emacs/master/src/bytecode.c:632
#1219 0x000000040013345b in fetch_and_exec_byte_code (args=0xbff4f8, nargs=0x1, syms_left=make_fixnum(1025), fun=XIL(0x40b4645)) at C:/emacs/git/emacs/master/src/lisp.h:1835
#1220 funcall_lambda (fun=XIL(0x40b4645), nargs=nargs@entry=0x1, arg_vector=arg_vector@entry=0xbff4f8) at C:/emacs/git/emacs/master/src/eval.c:3007
#1221 0x000000040013027b in Ffuncall (nargs=nargs@entry=0x2, args=args@entry=0xbff4f0) at C:/emacs/git/emacs/master/src/eval.c:2818
#1222 0x00000004001303fd in call1 (fn=fn@entry=XIL(0x3f30), arg1=<optimized out>) at C:/emacs/git/emacs/master/src/eval.c:2664
#1223 0x00000004000c339d in command_loop_1 () at C:/emacs/git/emacs/master/src/lisp.h:1007
#1224 0x000000040012f3fd in internal_condition_case (bfun=bfun@entry=0x4000c2fa0 <command_loop_1>, handlers=handlers@entry=XIL(0x90), hfun=hfun@entry=0x4000ba310 <cmd_error>) at C:/emacs/git/emacs/master/src/eval.c:1356
#1225 0x00000004000b3db8 in command_loop_2 (ignore=<optimized out>) at C:/emacs/git/emacs/master/src/lisp.h:1007
#1226 0x000000040012f36b in internal_catch (tag=tag@entry=XIL(0xe070), func=func@entry=0x4000b3d90 <command_loop_2>, arg=arg@entry=XIL(0)) at C:/emacs/git/emacs/master/src/eval.c:1117
#1227 0x00000004000b3d39 in command_loop () at C:/emacs/git/emacs/master/src/lisp.h:1007
#1228 0x0000000000000000 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Lisp Backtrace:
"line-pixel-height" (0xbfe968)
"line-move" (0xbfec70)
"previous-line" (0xbfefc0)
"funcall-interactively" (0xbfefb8)
"call-interactively" (0xbff230)
"command-execute" (0xbff4f8)


Eli, shout if you need help in digging in to this further (and if a -O0
build would be more useful).

    AndyM

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Eli Zaretskii]

> From: Andy Moreton <andrewjmoreton@gmail.com>
> Date: Thu, 24 Sep 2020 23:43:57 +0100
> 
> On Thu 24 Sep 2020, Simon Pugnet wrote:
> 
> > 1. Execute: emacs -Q
> > 2. In the scratch buffer that opens by default, activate Org mode: M-x
> > org-mode
> > 3. Type the following directly into the buffer (3 lines): -
> >
> > * Heading 1
> > ** Heading 1a
> > ** Heading 1b
> >
> > 4. The point should now be after the "b" in "Heading 1b"
> > 5. Evaluate (M-:) the following: (setq display-line-numbers-type 'visual)
> > 6. Activate display-line-numbers-mode: M-x display-line-numbers-mode
> > 7. Activate visual-line-mode: M-x visual-line-mode
> > 8. Hide other outline headings: M-x outline-hide-other
> > 9. Try to move the point to the previous line: C-p or previous-line
> >
> > If I perform these steps on Emacs 27.1 (GUI or text frame), and also the
> > packaged version of Emacs 26.3 on Android (via the Termux app), I always get a
> > segmentation fault.
> >
> > This happens in other Org mode buffers too, including those loaded directly
> > from the file system.
> >
> > I hope that helps!
> 
> With this recipe, I can reliably reproduce this on 64bit mingw64 on
> Windows (built with -O2). Running this produces the message:

Thanks, I installed a fix for this on the emacs-27 branch.  Please try
it.

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Simon Pugnet]

[-- Attachment #1: Type: text/plain, Size: 257 bytes --]

Eli Zaretskii <eliz@gnu.org> writes:

>
> Thanks, I installed a fix for this on the emacs-27 branch.  Please try
> it.

I've just rebuilt from emacs-27 and the problem is now fixed for me.

Thank you for the quick response and for all your work with Emacs!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]

bug#43589: 27.1.50; Crash in Org mode buffer when moving point after using outline-hide-other when visual-line-mode and visual line numbers are enabled

[Eli Zaretskii]

> From: Simon Pugnet <simon@polaris64.net>
> Cc: 43589@debbugs.gnu.org
> Date: Fri, 25 Sep 2020 11:00:29 +0100
> 
> > Thanks, I installed a fix for this on the emacs-27 branch.  Please try
> > it.
> 
> I've just rebuilt from emacs-27 and the problem is now fixed for me.
> 
> Thank you for the quick response and for all your work with Emacs!

Thanks for testing, I'm therefore closing this bug.